VulnSea
← All posts

VulnSea has moved to vulnsea.com (and what changed since September)

· VulnSea
announcementsapimcpsecurity

VulnSea now lives at vulnsea.com. The beta host, beta.vulnsea.com, has been retired, but nothing that pointed at it breaks. Here is what that means for you, followed by everything else that shipped since the September update.

The move

  • Every old link still works. Any beta.vulnsea.com URL now answers with a permanent redirect to the same path on vulnsea.com, query string included. That covers CVE pages, the .md twins, feeds, /llms.txt and the API, and every CVE link we have posted on Bluesky.

  • API and MCP clients keep working. The redirect is a 308, so a POST stays a POST with its body intact: an MCP client or an /api/sbom caller still pointed at the beta host gets a real answer. Do update your base URL when you get a chance. It saves a hop:

    https://vulnsea.com/api/mcp
https://vulnsea.com/api/cve

  • Your data came with you. The whole corpus (more than 66,000 CVEs at the time of the move), accounts, API keys, watchlists, saved searches and the PoC request queue all moved over as-is. API keys keep working unchanged.

  • You will need to sign in once more. Sessions are tied to the hostname, so everyone is signed out by the move. Sign in with GitHub or Google as before, and you land on the same account.

Faster pages

Public pages and anonymous API responses are now served from Cloudflare's edge cache: CVE pages, vendor and tag pages, the feeds, /llms.txt, /api/cve and /api/search. The app already sent the right cache headers; they are now acted on. Signed-in pages and anything per-user stay uncached, and freshness is unchanged: CVE pages refresh within ten minutes, the home feed within two.

Hardening

Before the move we ran a security review of the whole stack and fixed what it found. Nothing here required anything from you, but a few changes are visible to API and agent users:

  • Request limits. An MCP JSON-RPC batch now carries at most 20 messages, and each message counts once against your rate limit (anonymous 60/min, API key 600/min). Request bodies are capped: 256 KB for /api/sbom and the OSV endpoints, 1 MB for MCP. Both are far above any valid request (200 components or queries); anything larger gets a 413. Details are in the API and MCP docs.
  • Webhook alerts. Outbound alert webhooks no longer follow redirects, time out after 10 seconds, and refuse every private or internal address, including IPv6 forms that embed one. If your webhook endpoint answers with a redirect, point it at the final URL.
  • Sign-in and accounts. Sign-in requests are rate-limited per IP, cross-site writes to account endpoints are refused, and account changes check that the account is in good standing on every request.
  • Patched dependencies. The web framework and authentication library were updated to versions that fix recently published advisories. A vulnerability database had better run patched code itself.
  • /api/dump streams without blocking. The full-corpus NDJSON export no longer holds up other requests while a slow client reads it.

Also since September

  • Open data licence. VulnSea's own fields (depth score, zones, tags, notes, exploit aggregation) are licensed CC BY 4.0: reuse them freely with attribution. Upstream data keeps its publishers' terms.
  • A public status page with the state of the ingest pipeline and each data source.
  • No more duplicate Bluesky posts. A sync bug occasionally re-announced a CVE we had already posted; the cause is fixed.
  • Daily score refresh is more robust. The job that re-checks EPSS, KEV and public-exploit status for every CVE now handles the full corpus without strain, so scores stay current every day.

As always, if something you rely on looks off after the move (a link, an integration, a feed), tell us. The fastest way is a reply on Bluesky.

VulnSea has moved to vulnsea.com (and what changed since September) · VulnSea